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Abstract. The counterfeit coin problem requires us to find all false coins from a given bunch of 
coins using a balance scale. We assume that the balance scale gives us only "balanced" or "tilted" 
information and that we know the number k of false coins in advance. The balance scale can be 
modeled by a certain type of oracle and its query complexity is a measure for the cost of weighing 
algorithms (the number of weighings). In this paper, we study the quantum query complexity for 
this problem. Let Q(k,N) be the quantum query complexity of finding all k false coins from the 
N given coins. We show that for any k and N such that k < N/2, Q(k, N) = 0{k l / A ), contrasting 
with the classical query complexity, fl(k log(N/k)), that depends on N. So our quantum algorithm 
achieves a quartic speed-up for this problem. We do not have a matching lower bound, but we 
show some evidence that the upper bound is tight: any algorithm, including our algorithm, that 
satisfies certain properties needs f^/s 1 / 4 ) queries. 

1 Introduction 

Exponential speed-ups by quantum algorithms have been highly celebrated, but their specific ex- 
amples are not too many. In contrast, almost every unstructured search problem can be sped 
up simply by using amplitude amplification [SI EJ [6] , providing a huge number of combinatorial 
problems for which quantum algorithms are quadratically faster than classical ones. Interestingly 
there are few examples in between. (For instance, [7] provides a cubic speed-up while their classical 
lower bound is not known.) The reason is probably that the amplitude amplification is too general 
to combine with other methods appropriately. In fact we know few such cases including the one 
by [H] where they improved a simple Grover search algorithm for triangle finding by using clever 
combinatorial ideas (but unfortunately still less than quadratically compared to the best classical 
algorithm). This paper achieves a quartic speed-up for a well-known combinatorial problem. 

The counterfeit coin problem is a mathematical puzzle whose origin dates back to 1945; in 
the American Mathematical Monthly, 52, p. 46, E. Schell posed the following question which is 
probably one of the oldest questions about the complexity of algorithms: "You have eight similar 
coins and a beam balance. At most one coin is counterfeit and hence underweight. How can you 
detect whether there is an underweight coin, and if so, which one, using the balance only twice?" 
The puzzle immediately fascinated many people and since then there have been several different 
versions and extensions in the literature (see e.g., [T5 | l9l [T0 | f!3]). 

This paper considers the quantum version of this problem, which, a bit surprisingly, has not 
appeared in the literature. To make our model simple, we assume that we cannot obtain informa- 
tion on which side is heavier when the scale is tilted. So, the balance scale gives us only binary 
information, balanced (i.e., two sets of coins on the two pans are equal in weight) or tilted (different 
in weight). Our goal is to detect the false coin with a minimum number of weighings. The problem 
is naturally extended to the case that there are two or more (= k that is known in advance) false 
coins with equal weight. For the simplest case that k = 1, the following easy (classic) algorithm 
exists: We put (approximately) N/4 coins on both pans. If the scale is tilted, then we know the 
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false coin is in those N/2 coins and if it is balanced, then the false one should be in the remaining 
N/2 ones. Also, it is easy to see that two weighings are enough for N = 4. Thus [log N~\ weighings 
are enough for k = 1 and this is also an information theoretic lower bound. (The original version of 
the problem assumes ternary outputs from the balance, left-heavy, right-heavy and balanced, and 
that the false coin is always underweight. As one can see easily, however, the same idea allows us 
to obtain the tight upper bound of |~log 3 N~\ .) 

Our model of a balance scale is a so-called oracle. A balance oracle or simply a B-oracle is 
an A-bit register, which includes (originally unknown) N bits, x\X2 ■ ■ ■ xn G {0, 1}^. In order to 
retrieve these values, we can make a query with a query string q\q2 ■ ■ ■ qN G {0, 1, — 1}^ including 
the same number (= I) of l's and — l's. Then the oracle returns a one-bit answer x defined as: 

X = if xiqi + • • • + XNqN = and x = 1 otherwise. 

Consider x±, ■ ■ ■ , xn as N coins where means a fair coin and 1 a false one. Then, qi = 1 means we 
place coin X{ on the left pan and qi = — 1 on the right pan. Since we must have the same number 
of l's and —l's, the answer % correctly simulates the balance scale, i.e., x = means it is balanced 
and x = 1 tilted. The number of weighings needed to retrieve x\ through xjy (or to identify all the 
false coins) is called query complexity. 

The main purpose of this paper is to obtain quantum query complexity for the counterfeit coin 
problems. Observe that if we know in advance that an even-cardinality set X includes at most one 
false coin, then by using the balance for any equal-size partition of X we can get the parity of X, 
i.e., the parity of the number (zero or one, now) of false coins in X. This means that for strings 
including at most one 1, the B-oracle is equivalent to the so-called IP oracle [I]. Therefore, by 
Bernstein- Vazirani algorithm [3], we need only one weighing to detect the false coin. (Note that 
this observation was essentially done by Terhal and Smolin [H].) This already allows us to design 
the following quantum algorithm for general k: Recall that we know k in advance. So, if we sample 
N/k coins at random, then they include exactly one false coin with high probability and we can 
find it using the B-oracle just once as mentioned above. Thus, by using the standard amplitude 
amplification [6] (together with a bit careful consideration for the answer-confirmation procedure), 
we need 0{k) weighings to find all k false coins. For a small k, this is already much better than 
£l(klog(N/k)) that is an information theoretic lower bound for the classical case. 

Our Contribution. This paper shows that this complexity can be furthermore improved 
quartically, namely, our new algorithm needs 0(fc 1//4 ) weighings. Note that the above idea, the one 
exploiting Bernstein- Vazirani, already breaks down for k = 2, since the scale tilts even if the pans 
hold two (even) false coins if they both go to a same pan. Moreover, if k grows, say as large as linear 
in N, the balance will be tilted almost always for randomly selected equal partitions. Nevertheless, 
Bernstein- Vazirani is useful since it essentially reduces our problem (identifying false coins) to the 
problem of deciding the parity of the number of the false coins that turns out to be an easier task 
for B-oracles. By this we can get a single quadratic speed-up and another quadratic speed-up by 
amplitude amplification. 

We conjecture that this bound is tight, but unfortunately, we cannot prove it at this moment. 
The main difficulty is that we have a lot of freedom on "the size of the pans" (= the number of 
coins placed on the two pans of the scale), which makes it hard to design a single weight scheme of 
the adversary method pQ. However, we do have a proof claiming that we cannot do better unless 
we can remove the two fundamental properties of our algorithm. These properties are (i) the big- 
pan property and (ii) the random-partition property. We have considered several possibilities for 
escaping from them, but not successful for even one of them. 

Related Work. Query complexities have been studied almost always for the standard index 
oracle, which accepts an index i and returns the value of Xj. Other than this oracle, we know few 
ones including the IP oracle [3] mentioned before and the even more powerful one that returns 
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the number (not the parity) of l's in the string [19]. Also, [JJj] presented a single-query quantum 
algorithm for the binary search problem under the IP oracle, which is essentially based on the same 
idea as the k = 1 case of our problem mentioned above. 

The quantum adversary method, which is used for B-oracles in this paper, was first introduced 
by Ambainis [JJ for the standard oracle. Many variants have followed including weighted adversary 
methods [2j [20] , spectral adversary method [3] , Kolmogorov complexity method [12] , all of which 
were shown to be equivalent [18] . After Hoyer et al. [IT] introduced a stronger quantum adver- 
sary method called the negative adversary method, Reichardt |16[ [TT] showed that this method is 
"optimal" for any Boolean function. 

Models. A B-oracle is a binary string x = x\ ■ ■ ■ xn where x% = 1 (resp. = 0) means that the 
i-th coin is false (resp. fair). For instance, the string 0001 for N = 4 means that the fourth coin is a 
unique false coin. A query to the oracle is given as a string q = q\ ■ ■ ■ q^ € {0, 1, — 1}^ that must be 
in the set = |jj=o 2 "' Qi where Qi is the set of strings q such that q has exactly I l's and I —l's. 
Here, 1 (or —1, resp.) in the i-th component means that we place the i-th coin on the left pan (on 
the right pan, resp.) and means that the i-th coin is not placed on either pan. The answer from 
the oracle is represented by a binary value x(x; q) where x( x l l) = means the scale is balanced, 
that is, qiX\ + . . . + qjyxjy = and x( x 'i ?) = 1 means it is tilted, that is, q±x\ + . . . + qjyxjy ^ 0. 
In quantum computation, the B-oracle is viewed as a unitary transformation Ob,x- Namely, Ob,x 
transforms \q) to (—l) x ^ x ' qS> \q) . Throughout this paper, we assume that k < N/2 since our B-oracle 
model is unable to distinguish any JV-bit string x from x (the bit string obtained by flipping all 
bits of x). 

2 Upper Bounds 

Here is our main result in this paper: 

Theorem 1 The quantum query complexity for finding k false coins among N coins is 0(/c 1 / 4 ). 

Notice that our algorithm is exact, i.e., its output must be correct with probability one to 
compare our result with the classical case (which has been often studied in the exact setting). 
Since we use exact amplitude amplification [6] to make our algorithm exact, the assumption that k 
is known is necessary. But it should be noted that our bounded-error algorithm described in this 
section works even for unknown k. Also, we note that our algorithm can be easily adapted so that 
it works when the output of the balance is ternary (while we assume it is binary for simplicity) . 

Before the proof, we first describe our basic approach, a simulation of the IP oracle by the 
B-oracle. Recall that the IP oracle (Inner Product oracle) [1] transforms a prequery state |5)r to 
(—l) q ' x \q)f(, where g£ {0, 1}^ in register R is a query string and x £ {0, 1}^ is an oracle. Then the 
Bernstein- Vazirani algorithm (the Hadamard transform) retrieves the string x and we know the k 
false coins in the case of our problem. Observe that the IP oracle flips the phase of each state if 
and only if q ■ x is odd, in other words, if and only if a multiset M(q,x) := {xj | qi = 1} includes 
an odd number of l's (or false coins in our case). If k = 1, then M(q,x) includes at most one 1. 
Hence we can simply replace the IP oracle with the query sequence q by the B-oracle with a query 
sequence q such that an arbitrarily one half (the first one half, for instance) of the l's in q are 
changed to —l's, meaning the one half of the coins in M(q, x) go to the left pan and the remaining 
one half to the right pan. (As shown in a moment, we can assume without loss of generality that 
q includes an even number of l's.) 

Now we consider the general (k > 1) case. If M(q,x) includes odd l's, then the scale is tilted 
for any such q mentioned above; this is desirable for us. If M(q,x) includes even l's, we wish the 
scale to be balanced. In order for this to happen, however, we must divide the (unknown) false 
coins in M(q, x) into the two pans evenly, for which there are no obvious ways other than using 
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randomization. Our idea is to introduce the second register, R', as follows: On R', we prepare, with 
being entangled to each state q in R, a superposition of all possible states q\ (q) , q 2 (9) , . . . ,9/1(9), 
obtained by flipping one half of l's in q into — l's. By using this superposition as a query to the 
B-oracle, we can achieve a success (being able to detect the scale is balanced) probability of 1/y/rti, 
where m is the number of false coins in M(q,x). In order to increase this probability, we can use 
copies of register R' or, more efficiently, quantum amplitude amplification [6]. 

As suggested before, we begin with the restriction of the IP oracle without losing its power. 
The parity-restricted query means that the Hamming weights of all superposed queries q, denoted 
by wt(q), are even. 

Lemma 1 Let S <N/2 := {x G {0,1}^ | wt(x) < N/2}. Then there is a quantum algorithm to 
identify an oracle in by a single parity-restricted query for the IP oracle. 

Proof. For a given oracle x G 5 , < tv/ 2 , define 

I'M = 7^=i £ (-UH3)- 

en 

where Qeven = {q G {0, 1}^ | wt(q) = mod 2}. Then the Hadamard transform of \ip x ), H\ip x ), 
can be rewritten as follows: 



H \**) = Tprf E (-if x m = ^Tr 2 E E ( 

q^Qeve-n q&Qeve-n Z£{0,1} N 



\q-(x®z) I 



Q(zQ even Z^-X^X 



V2 

Note that the last equality in the above equations holds; the second term must vanish because 
the first term already has a unit length. For any x 7^ y, H\ip x ) = (\x) + \x))/y/2 and H\ip y ) = 
(\y) + |y))/v^2 are orthogonal since x 7^ y by the restriction of their Hamming weights. This 
implies that \ip x ) is orthogonal to \ip y ) for any x 7^ y, and hence there is a unitary transformation 
W : \x) 1— > IV'x)- Thus we can design an algorithm similar to Bernstein- Vazirani [4] just replacing 
the Hadamard transform by W. For a concrete (polynomial-time) construction of W, see Appendix 

El □ 

Now we give the proof of our main result. 

Proof of Theorem Q3 For exposition, we first give a bounded-error algorithm (Find* (k)) and 
then make it exact (Find(k)). In what follows, for a query string q, let I(q) be the set of indices 
i such that qi = 1. This set specifies which wt(q) coins of the coins are placed on the two pans. 
Let Pi(q) be the set of all partitions of the set I(q) of size wt(q) (= even by Lemma[l| into two sets 
of size wt(q)/2. Note that each partition (Y,Y) in Pirn specifies how to split the wt(q) coins in 
half to place them on the left and right pans, and can be identified with the corresponding query 
q to the B-oracle. Finally, let x(Y, Y) be the answer for the query (Y, Y) G Pj(<n to the B-oracle. 

Algorithm Find*(k). 

1. Prepare N qubits |0)® in a register R, and apply a unitary transformation W of Lemma[T] 
to them. Then, we have the state ^= EgeQ e „e« 15) R- 

2. For each superposed <f, implement Steps 2.1-2.4 on a register R' using q as a control part. 
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2.1. Apply a unitary transformation Aq to the initial state |0) on R' to create a quantum state 
Aq\0) := _^|p | X)(yy)ePf(-^ I^>^Or'> which represents a uniform superposition of all partitions 

(Y,Y) in Pi(q\- Then, the current state is 

16.1) = £ |5) R E 7«IW r , 

= E E 7«|y,F) R /+ E I5>r E t«i^F) r . 

geQ e „ e „nQ e (y,y)eP J(5) geQ e „ e „nQ (y,F)eP /(?) 

where Q e (resp. Q D ) denotes the set of all <fs such that M(q, x) includes an even (resp. odd) number 
of l's. Also, 7 = l/y/2 N ~ 1 and a = 1/J\P I(S) \. 

2.2. Let x be the Boolean function defined by %(Y, Y) = 1 if and only if xO^j ^) = (that is, 
the scale is balanced). Then, under the above Aq and x, run the amplitude amplification algorithm 
QSearch(^lq-, x) when the initial success probability of Aq is unknown (Theorem 3 in [6]). Here 
"success" means the scale is balanced and hence we use x, not x> m QSearch. Then we obtain a 
state in the form of 

16.2) = E I5>R E iPy%Y,9y)w+ E I5>R E MY,Y,g Y ) RI 

q&QevenDQe (yY)&Pl(q) qeQevenHQo (Y,Y)ePl^ 

where \gy) is the garbage state. Note that, in the first term, the amplitudes (3y such that x(^> Y) = 
1 are now large by amplitude amplification while the second term does not change since the scale 
is always tilted. 

2.3. If Step 2.2 finds a "solution," i.e., a partition (Y,Y) such that x(Y, Y) = 1, then do 
nothing. Otherwise, flip the phase (and then the phase is kick-backed into R). Notice that when 
M(q,x) includes an odd number of l's, the phase is always flipped, while when it includes an even 
number of l's, the phase is not flipped with high amplitude. Now the current state is 

I6,s) =E l«>R E^-l) x(y ' F) W<?y)R' -E l§>R E^ a l y > F 'Sy>R' 

qeQevennQe {YY)&Pi(q) q£Qeve n nQ (Y,Y)ePi(g) 

= E I5>R E iPy\Y,Y,9y)r> - E I5)R E ia\Y,Y,g Y ) R ,-2 £ ^err^R/ 

q&Qeve n C\Qe (Y,Y)ePl(S) q^QevenClQa (Y,Y)ePug) q&QevenC\Qe 

where \errq) R , = E(y,y) 6 p I(5) : X (y,y)=i iPy\Y,Y ,g Y ) w . 

2.4. Reverse the quantum transformation done in Steps 2.1 and 2.2. Notice that the 
reversible transformation is done on R' in parallel for each q while the contents of R does not 
change since it is the control part. Therefore, the state becomes 

I6, 4 ) = E I5>rI°>* - -j=_ E I5)rI°)r' - 2 E I5>rI«i> 

= 7P=f E (-lPl5)R|0)R'-2 £ |5) R |err> 

where |err~) R / is the transformed state of |errg) R /. 

3. Apply W^ 1 to the state in R. Then we obtain a final state 

16) = \x)r\0)r. - 2W" 1 I £ |§> R |erV f ) R / 

Xq&QevenClQe 
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Then measure R in the computational basis. (End of Algorithm) 



For justifying the correctness of Find*(k), it suffices to show that the squared magnitude of the 
second term of ^3) is a small constant, say, 1/400, since we then measure the desired value x with 
probability at least 9/10 (in fact, at least (1 — y/l/400) 2 > 9/10). By the unitarity, its squared 
magnitude is equal to that of the last term of (£2.3) > that is, we want to evaluate the following 
value e. 



)R\errq) R , =4 E \q) R |||errg-) R /|| . 
Lemma 2 e is at most 1/400. 

Proof. Consider an arbitrary q in Q even n Q e . When M(q,x) includes m (< k) l's (where m is 
even), the state Aq\0) includes a partition (Y,Y) such that x(Y,Y) = 1 with probability at least 



P 



I m \ I wt(q)—m \ 
Km/2) \{wt{q)-m)/2) 

I wt(q) \ 

\wt(q)/2J 



0(1/ 



111 



Q(l/Vk). 



By Theorem 3 in [6], it is guaranteed that, in the algorithm QSearch(^4^, %), an expected number 
of applications of the Grover-like subroutine to find a "solution," i.e., a partition (Y, Y) such that 
x(Y, Y) = 1, is bounded by 0(1/ y/p) = 0{k 1 ^). The subroutine consists of (i) Aq, (ii) its inverse, 
(iii) the transformation defined by 0^\Y,Y) = (— 1) X ^ Y ' Y ^\Y, Y), and (iv) the transformation Uq 
defined by Uq\z) = \z) if z 7^ and —\z) if z = 0, where Aq (and hence its inverse) and Uq 
can be implemented without any query to the B-oracle, and can be implemented with one 
query to the B-oracle. Thus the expected number of queries to find a "solution" is 0(k 1 ^). 
By setting the number of applications of the subroutine to cofc 1 / 4 where Co is a large constant, 
Step 2.2 finds a "solution" with probability at least 1599/1600. This means that for any q G 
Qeven Qe, Y1(y y)eFj -j -x(y Y)=o @ Y l^"> ^> 9 Y ) R/ nas s( l uare d magnitude at most 1/1600. Recalling 
1/V2 N ~ 1 we have 
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47 2 E 



E 



f3 Y \Y,Y,g Y ) R , 



(Y,Y)£Pi<m--x(Y,Y)=0 



< 1/400. 



This completes the proof of Lemma [2j 



□ 



Finally, it is easy to see from the above proof that the query complexity of Find*(k) is 0{k 1 ' 4: ) 
since it makes 0(k 1 ^) queries in Step 2 and no queries in Steps 1 and 3. 

Now we consider the exact algorithm Find(k). By the symmetric structure of algorithm 
Find*(k), the success probability of identifying x correctly is independent of x (recall that the 
oracle candidates are ( ■ ) iV-bit strings x with Hamming weight k). Thus we can use the so-called 
exact amplitude amplification algorithm (Theorem 4 in [6]) to convert it into the exact algorithm. 

Here is the brief description of Find{k). (see Appendix [B] for the details). First, we implement 
Find*{k). As shown above, Find*(k) produces the correct output (i.e., k false coins) with a constant 
probability (> 9/10) larger than 1/4. Notice that we can make the success probability exactly 1/4 
by an appropriate adjustment. We need an algorithm for checking if the output is correct to amplify 
the success probability to 1. Namely, an algorithm Check needs to judge whether k coins are indeed 
all false, which can be implemented classically in 0(log k) weighings (as seen in Appendix[B]). Then 
we can implement the exact amplitude amplification: Like the 1/4-Grover's algorithm [5], flip the 
phase if Check judges that the output is correct, and apply the reflection about the state obtained 
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after Find*{k). It is not difficult to see that Find(k) always finds k false coins and the total 
complexity is 0{k 1 ^). Therefore, the proof of Theorem Q] is completed. □ 



3 Lower Bounds 
3.1 Basic Ideas 

In this section, we discuss the lower bound of finding k false coins from N coins. We conjecture 
that the upper bound 0(fe 1//4 ) is tight but, unfortunately, we have not been able to show whether 
it is true or not. Instead, we show that if there would be an algorithm that improves the upper 
bound essentially, then it would have a completely different structure from our algorithm. 

Before describing our results, we observe two properties of our algorithm Find(k). First, 
Find(k) essentially uses only "big pans," i.e., it always places at least Q(N) coins on the pans, 
which is called the big-pan property. (The algorithm Find*(k) in Section [2] uses "small pans" but 
it can be adapted with no essential change so that it works even if the size of pans must be big, as 
easily shown in Appendix|Bj) Second, the B-oracle is always used in such a way that once the coins 
placed on the two pans are determined, the partition of them into the two pans is done uniformly 
at random, which is called the random-partition property. What we show in this section is that the 
current upper bound is best achievable for any algorithm that satisfies at least one of these two 
properties. 

For this purpose, we revisit one version of the (nonnegative) quantum adversary method, called 
the strong weighted adversary method in |18j . due to Zhang |20] , Let / be a function from a finite 
set S to another finite set S' . Recall that in a query complexity model, an input x G S is given as an 
oracle. An algorithm A would like to compute f(x) while it can obtain the information about x by 
a unitary transformation O x \q, a, z) = \q,a® C( x ', l)i z )i where |g) is the register for a query string 
q from a finite set Q, \a) is the register for the binary answer £(x;q), a function from S x Q to 
{0, 1}, and \z) is the work register. Note that the adversary method usually assumes the so-called 
index oracle, namely q is an integer 1 < i < N and ((x; q) is the ith. bit (0 or 1) of x G {0, 1}^. 
However, one can easily see that the above generalization to q) requires no essential changes 
for its proof. Thus Theorem 14 of [20] can be restated as follows: 

Lemma 3 Let w, w' denote a weight scheme as follows: 

1. Every pair (x,y) G S x S is assigned a nonnegative weight w(x,y) = w(y,x) that satisfies 
w(x,y) = whenever f(x) = f(y). 

2. Every triple (x,y,q) G S x S x Q is assigned a nonnegative weight w'(x,y,q) that satisfies 
w'(x, y, q) = whenever ((x; q) = q) or f(x) = f(y), and w'(x, y, q)w'(y, x, q) > w 2 (x, y) 
for all x, y, q such that ((x; q) / ((y; q) and f(x) / f(y). 

For allx,q, let fj,{x) = ^2 y w(x,y) and u(x,q) = ^2 y w'(x,y,q). Then, the quantum query complex- 
ity of f is at least 

( 



n 



max mm 



x,y,q:*w{x,y)>0, V u(x, q)v(y, q) 



3.2 Big Pan Lower Bounds 

First, we show that our upper bound is tight under the big-pan property. In what follows, L > I 
denotes the restriction that at least I coins must be placed on the pans whenever the balance is 
used. 
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Theorem 2 If L > I, we need ^((Ik/N) 1 ^) weighings to find k false coins. In particular, f^/c 1 / 4 ) 
weighings are necessary if there is some constant c such that L > N/c. 

Proof. Let I = N/d. Then the lower bound we should show is ^((fc/d) 1 / 4 ). We can assume that 
d < k/3 (otherwise, the lower bound becomes trivial). To use Lemma [3l let S={i£ {0,1}^ | 
wt(x) = k}, Q = Q>N/d '■= V]i>N/dQi-> C{ x 'iQ) = x( x '>l)i an( A f{x) = x. Our weight scheme is as 
follows: Let w(x,y) = 1 for any pair (x,y) G S x S such that i/j/, and let w'(x,y,q) = 1 for all 
(x,y,q) £ S x S x Q> pju such that x{ x \ l) 7^ x(V'i q) an d x ^ y. It is easy to check that this satisfies 
the condition of a weight scheme. Then, for any x, we have pb{x) = J2 y w(x, y) = ( fc ) — 1. We need 
to evaluate v{x,q)v(y,q) for pairs (x,y) such that q) = 1 and xXv'il) = or q) = and 
x(y>o) = 1- Fix q £ Q>N/d arbitrarily and assume that q £ Qjv/c where c < d. When g) = 1 
(i.e., the scale is tilted for query q when x is the input), notice that v(x,q) = ^2 y w'(x,y,q) is the 
number of all y's such that the scale is balanced when N/c coins are placed on each of the two pans 
according to q. Therefore, by summing up all the cases such that those N/c coins include m false 
ones, 

^>-<».M^|(r)Tv-tr> 



m=0 

(N\ 



Since x(y'i q) = 0) we have v(y,q) = ^2 x w'(x,y,q) = (, ) — y(N,k,c) by counting all x's such that 
the scale is titled. Then the product z/(a;, q)v{y, q) is 7(iV, A;, c) ^(^) — ^(N, k, c)J . Similarly, when 

x(#;<z) = 1 we can see that the product is also y(N,k,c) f(^) — 7(iV", fc, c)V By Lemma [3] the 
quantum query complexity of our problem is at least 



I min 



-ft min W ; Vfc/ - . (11 

c:c<d^ 7 (JV,fc,c)((J)-7(iV,fc ) c)) J \c:c<d\j "f(N,k,c" 

Then, we can show the following lemma. 

Lemma 4 j(N,k,c)/(f) = O(y^cjk) for any 2 < c < d (< fe/3). 

Proo/. Note that j(N ,k,c) / \ k ) means the probability that the scale is balanced when N/c coins 
(N coins include k false ones) are randomly placed on each of the two pans, and hence its value 
decreases as c approaches to 2. So, it suffices to prove the lemma for c > 4. 

Let us denote each term in the sum j(N, k, c) by t{m) = (^ c ) {^-2 ) ^ or m = 0, 1, . . . , k/2. 
We divide j(N,k,c) into the two parts, that is, we write j(N,k,c) = T >k j 2c + T <k / 2c where 

T >k /2c = E m:m >fc/2c t ( m ) aIld T <k/2c = Hm:m<k/2c t ( m )- For the P r °° f > it: Suffices to show that 

both T >fc / 2c /(fc r ) an d T<k/2cl '('&) are bounded by 0{^Jc/k). First we consider T >k / 2c /( N k ). When 
N/c coins are randomly placed on each of the pans, let E\ be the event that at least k/2c false 
coins are placed on the pans, and E 2 be the event that the scale is balanced. Then, we can see 
that T >k/2c /{ N k ) = Pr[£i A E 2 ] which is at most Pr[£ 2 |£i] = 0(1/ ^/kfc) = 0{^/c/k). Second we 
consider T<fc/2 C /(jfc)- Let r(m) = t(m + l)/i(m). Note that r(m) is monotone decreasing on m 
since 

/ N/c\ 2 ((l-2/c)N\ 

, . Vm+1/ \fc-2(m+l)/ 
7" I 772 ) = — 

(N/c\ 2 ((l-2/c)N\ 

V m ) V fc-2m / 

(f - m) 2 (A; - 2m)(lfe - 2m - 1) 



(m + 1) 2 ((1 - 2/c)N — k + 2m + 1)((1 — 2/c)iV - fc + 2m + 2) 



S 



Now we verify that r(k/2c — 1) > 4. In fact, since c < k/3 < 2 + k/2, we have 

(1 - 2/c)N - k + k/c < (1 - 2/c)(N - k/2 - c) (2) 



and 

Thus we obtain 

r(k/2c 



k - k/c- 3 > k(l - 2/c). (3) 
(l/c) 2 (iV - k/2 - c) 2 (k - k/c -2)(k- k/c - 3) 



{k/2c) 2 {{\ - 2/c)N - k + k/c)((l - 2/c) AT - k + fc/c- 1) 
4(fc -k/c-'. 

>4 (byEq.© 



4(fc-A;/c-2)(fc-A:/c-3) „ „ 

> - — w - W — (by Eqm 



These facts imply that 



T <k/2c= E t(m)<(l + l/A + (l/A) 2 + ---)t(k/2c) = (4/3)t(k/2c), 

m:m<k/2c 

which is bounded by (4/3)i(fc/c) since t(m) takes the maximum value when m = k/c. Calculating 
t{k/c)/{^) using the Stirling formula n\ ~ \/ 2irn(N / e) N , we obtain 

, , /Af/c\ 2 /(l-2/c)7V\ fcj {N-k)\ 

#) _ U/J l(l-2/c)J _ ((f)!) 2 ((l-^)fc)! ((^)0 2 ((l-|)(jV-fc))! 
Af\ aW\ AT! 



((f )0 2 ((l-f)W)! 
ciV 



2nk(N- k)y/l - 2/c 



which is bounded by 0{c/k) since k < A^/2 and c > 4. Thus, the sum r<^/2 C /(i.) is bounded by 
0(c/fc) = 0(y/c/k). From the above, we obtain ^(N ,k,c) / { N k ) = 0(y/c/k). □ 



Now Lemma S] implies the desired bound ^((fc/d) 1 / 4 ) by Eq.([T|), and hence the proof of Theo- 
rem [2] is completed. □ 

On the contrary, we can show that any algorithm that uses only "small pans" also needs ^(fc 1 / 4 ) 
queries (Theorem [5]) . For instance, we cannot break the current bound fe 1//4 by any algorithm that 
places 0(N/k) coins on the pans. (Notice that the pan includes only a constant number of false 
coins with high probability in this case and therefore we can achieve a better success probability 
for the even false-coin case, but at the same time, we cannot use a wide range of superpositions). 
Moreover, we can obtain another lower bound for the case where "big pans" and "small pans" are 
both available but "medium pans" are not (Theorem [6]) . Unfortunately one can see that there is 
still a gap between the sizes of the big pans and small pans even for a weakest nontrivial (w(l)) 
lower bound. See Appendix O for the details of these results. 



3.3 Lower Bounds for the Quasi B-Oracle 

Second, we show that our upper bound is tight under the random-partition property. Notice that 
in this case, if the coins include an odd number of false ones, then the scale is always tilted, and if 
the coins include an even number (=m) of false ones, the scale will be balanced with probability 
1/y/m. Thus in order to show a lower bound, we need to generalize the adversary method that 
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works for such "stochastic" oracles: Now £(x; q) is a random variable and the stochastic version of 
O x , denoted by O x , is defined as (we should be careful not to lose its unitarity): 



Now Lemma [3] changes to the following: 
Lemma 5 Let w,w' denote a weight scheme as Lemma\^ except replacing Condition 2 to 

2' Every triple (x,y,q) £ S x S x Q is assigned a nonnegative weight w'(x,y,q) that satisfies 
w'{x, y, q) = whenever Pr[((x; q) = ((y; q)] = 1 or f{x) = f(y), and w'(x, y, q)w'{y, x, q) > 
w 2 (x, y) for all x, y, q such that Pr[£(x; q) / q)] > and f(x) / f{y)- 

Then, the quantum query complexity of f is at least 



where P a b,q = Pr[C(x; q) = a]Pr{((y; q) = b). 

Proof. The proof follows that of [20|, Theorem 14] essentially; in the following we mainly describe 
the difference. Assume that there is a T-query quantum algorithm A computing / with high 
probability. Note that the initial state of A is \ip®) = |0) for any input x. The final state for input 
x can be written as \ip^) = Ut-iO x ■ ■ ■ UiO x Uq\0) for some unitary transformations Uq, • • • , Ut-i- 
Since A computes / with high probability, there is some constant e < 1 such that \(ip x \ipy)\ ^ 6 
for any x and y with f(x) ^ f(y)- Let |^) = Uk-iO x ■ ■ ■ U\O x Uq\§) . For any x and y with 
f(x) 7^ /(y), we can represent 



O 



X 



q,a,z) = VPr[C(x; q) = 0]\q, a, z) + (-l)VPr[C(z; o) = %, a®l,z). 






After querying to the oracle, we have 



Ox^t 1 ) 



J2 a q>a , z ( v /PT[((x;q)=0]\q, a, z) + (-1) "y/Vifcix; q) = l]\q, a®l,z)) 



^(v/Pr[C(a;; q) = 0]a q , a>z + (-l) ael y/Pi[<;(x; q) = T]a q>am>z )\q, a, z), 



Oy\^ 1 ) 



^(VPr[C(y;g) = o]V, 2 + (-i) ae VPr[C(y;g) = T]P q , a ®i, z )\q,a,z). 



Hence we have (recall that P a b,q '■= PrfC^;?) = a ]P r [C(y; (?) = b])'- 




'q,ai 



^ + E(- 1 ) ael v^ a 3 





q,a( 



m,z + ^ (-!)" V P 10,q a *q,a,zP< 
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On the contrary, 

q,a,z 

Thus the difference between (V'x -1 !^ -1 ) an( A {ipxli'y) * s 

(^'Vy' 1 ) ~ Mrf) = E [t 1 " V^)^ tA . 

< ? ,a,2:Pr[C(x;g)^C(y;9)]>0 



+ (- 1 ) a (\A^9 a g,a,2/ 3 g,a©l,2 - V Howag |0 , 2 ^?,offil,i 

since Pr[£(x; q) = ((y; q)] = 1, that is, -Poo,<? + P\\,q = 1 implies that -Poo,q = 1 or Pn, g = 1. By the 
triangle inequality, 



i - e < i - iwJiOi < £ i»i _1 i</'J-') - 



ft 

fe=i 



i 

<Y1 Yl [(! - V P 00,q ~ y/Pll,q)\(*q,a,z\\Pq,a,z\ + W P 01,Q + V P W,q) \<Xq,a,z \ \Pq,a®l, 



' Pr[C(x;g)^C(y;9)]>0 



< E E K V P 01 l9 + y/Pw,q)(\a qt a,z\\P q ,a,z\ + |awllAr,affil,*l)]- 



k=l 1,o-,z 

Pr[((x;q)^(;(y,q)}>0 

The remaining part is completely similar to the proof of [20^ Theorem 14] . Summing up the in- 
equalities for all (x, y) £ SxS with weight w(cc, y), we have (1— e) J2 X y w(x, y) < 1TA=^ Ylx y w ( x -> v) 
where 

A= min ^ X) ^ y) -— 1 - . 

x,y,q: w(x,y)>0 u(x, q)V{y, q) (JPoi, q + W P 10,q) 2 
Pr[C(x;g)^C(y;9)]>0 

Therefore, we obtain T = Cl(y/A) and hence the proof is completed. □ 
Now we define the stochastic version of our B-oracle by setting 

{0 (if wt(x A q) is odd) 

y/l/wt(x A q) (if wt(x A q) is positive and even) 
1 (if wt{x Ag) = 0), 

where x and q are iV-bit strings, and x A g is the iV-bit string obtained by the bitwise AND of 
x and q. We call this oracle the quasi B-oracle and one can see that it simulates the B-oracle 
with the random-partition property. Now we are ready to give the upper and lower bounds for 
the query complexity of this quasi B-oracle. Assume that wt(x) = k. The upper bound is easy by 
modifying Theorem Q] so that Step 2 in Find*(k) can be replaced with 0{k l / i ) repetitions of the 
quasi B-oracle. 

Theorem 3 There is an 0(k 1 / 4 )-query quantum algorithm to find x using the quasi B-oracle. 

On the contrary, we can obtain the tight lower bound by using Lemma [SJ The weight scheme 
contrasts with that of Theorem [2j w(x,y) is nonzero only if the Hamming distance between x and 
y is 2. 

Theorem 4 Any quantum algorithm with the quasi B-oracle needs f2(A; 1//4 ) queries to find x. 
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Proof. First we define a weight scheme. Let S = {x G {0, 1}^ | wt(x) = k} and /(x) = x. In 
what follows, we assume that wt(q) = I for the q that provides the minimum value of the formula 
of Lemma and show that the theorem holds for an arbitrary I < N. For any (x,y) £ S x S, let 
w(x,y) = 1 if d(x,y) = 2 and otherwise. We must satisfy w'(x,y,q) = for any different x,y 
such that d(x,y) ^ 2 or Pr[((x;q) = q)] = 1, which implies wt(x A q) = wt(y A q). Thus we 
let u/(x, y, q) ^ only if y) = 2 and Aq) = wt(y A q) ± 1. Define u/(x, y, q) as a function 
of u>i(x A q) = mi and iot(y A q) = m 2 , and thus denote it by w'(x,y,q) = w' (mi, 7712). Then 
w' (1711,1712) is taken as 

I FfSfagl] if (mx, ^5 = (2m -1,2m) 

«/(mi,m 2 ) = j 2mTJ-i-iS jf (mi,m 2 ) = (2m,2m-l) 

1 if (mi, m 2 ) = (2m, 2m + 1), (2m + 1, 2m) 

otherwise. 

It can be easily seen that w, w' is a weight scheme. Now we evaluate the lower bound under this 
weight scheme. Clearly, ji(x) = (i(y) = k(N — k). For evaluating i/(x,q)v(y,q), we consider only the 
case where mi = wt(x Aq) = 2m and m 2 = wt(y A q) = 2m — 1 (the other cases such as mi = 2m 
and m 2 = 2m + 1 can be similarly analyzed). In this case, we have 

z/(x, q) = 2m(N — I — k + 2m)u/(2m, 2m - 1) + (k - 2m)(l - 2m)w'(2m, 2m + 1) 
<(l-2m + l)(k - 2m + 1) + (k - 2m) (I - 2m) 

< 2(1 - 2m + \)(k - 2m + 1), 

u(y, q) = (2m - 1)(N — k — l + 2m— l)w'(2m -1,2m- 2) 
+ (k-2m + l)(l-2m+ l)w'(2m - 1, 2m) 

< (2m - 1)(N - k - I + 2m - 1) + 2m(iV — k — l + 2m) 

< 4m(N -k-l + 2m). 



Note that since Pr[((x;q) = 0] = v / T/2m and Pr[C(y;g) = 1] = 1, P i, q = 1/V2m and P 10 , q = 0. 
Thus we have 

H(x)(i(y) 1 k 2 (N - k) 2 V2m 



v(x, q)u{y, q) {^/P^~ q + ^/P^,) 2 8m(l - 2m + l)(fc - 2m + 1)(N - k - I + 2m) ' 

This value is bounded below by $l(k l l 2 ) since m < k/2 and I < N. Now Lemma [5] completes the 
proof. □ 
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A Efficient Construction of Transformation W 



It can be easily seen that our algorithm Find*(k) can be implemented in time polynomial in the 
length of the input except for a bit nontrivial task, constructing the transformation W. Precisely, 
W is a unitary transformation that satisfies W\x) = \i]) x ) := y , 2 1 N _ 1 YlqeQ even {~^Y' x Wl f° r anv 
x G S<n/2- We define a subset Sih of size 2 N /2 as follows: Sih = £<jv/2 if N is odd, or Sih = 
S<n/2^{ x £ {0) l}^' 2 | lex(x) < 2 N / 2 /2} (where lex(x) is the lexicographic order of x in {0, 1} N / 2 ) 
if is even. Notice that Sy, is a polynomial-time computable set. Then the following algorithm 
implements W. 

Algorithm Ayy- Input: \x) such that wt(x) < N/2 in a register S. 

1. Create the quantum state ^{\%) + \x)) in S by Steps 1.1-1.3. 

1.1. Prepare ^-(|0) + |1)) in a register R. 

1.2. If the content of R is 1, flip all the N bits in S. 

1.3. If the content of S is not in Sih, flip the bit in R. 

2. Apply the Hadamard transform on S. 

3. Let S be the output. 

It is easy to see that A\y is implemented in polynomial time. By Step 1.1, we have -^|x)s(|0) + 
1 1) ) r . After Step 1.2, the state becomes ^(|»)s|0)r + |x)s|I)r). Step 1.3 transforms the state to 

4=(|*>s|0)r + \x)s\0)r) = 4=(I*>S + l^)s)|0) R . 



Finally, the state after Step 2 is 



^(-^(|x)s + |x)s))|0) R = ^,)s|0) R 



as shown in the proof of Lemma [TJ 



B Algorithm Find(k) 

The exact algorithm Find(k) is given as follows. 



Algorithm Find( k). Let a (> 9/10) be the success probability of Find*(k). Let B be the algorithm 
that uses a single qubit with initial state |0) and rotates it to \/l — l/4a|0) + yl/4a|l). Notice 
that the probability that Find*(k) succeeds and B outputs |1) is exactly 1/4. 

(i) Run Find*{k) with initial state |0)r in the register R and obtain a candidate of k false coins 
X (in fact, the corresponding oracle), and also run B with initial state |0)r/ in the register R'. Let 
U be the unitary transformation done in this step (that is, the state after this step is C/|0)r|0)r/). 

(ii) Implement Steps (ii-1)— (ii-3) below. 

(ii-1) Run algorithm Check, which will be described later, to check if X is indeed the set of 
k false coins. 

(ii-2) If Check outputs YES and B outputs |1), flip the phase. Otherwise, do nothing. 
(ii-3) Reverse the operation of Step (ii-1). 

(iii) Apply the reflection about the state f7|0) R |0) R /, i.e., I - 2[/|0)(0|f/ t , where |0) = |0) R |0) R /, 
to the state. 

(iv) Measure R in the computational basis. 
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By a geometric view (Theorem 4 in [6]) similar to the Grover search where the fraction of correct 
solution(s) is 1/4 [5], we can verify that Find(k) succeeds with certainty. In Find(k), the "solution" 
is |X)r|1)r/ where X is the k false coins. Notice that Step (ii) implements the transformation that 
changes |X)r|6)r/ to — |X)r|6)r/ if (X, b) is the "solution" and |X)r|6)r/ otherwise. The total 
complexity is the number of queries to run Find*(k) and its inverse three times (once for Step (i) 
and twice for Step (hi)) plus the number of queries to run Check and its inverse. So, we obtain a 
query complexity of 0{k 1 ^) if Check has a similar complexity. 

In fact, Check needs only 0(\ogk) queries, which is given as follows. For simplicity, we assume 
that N is a multiple of k + 1 and k + 1 is a power of 2 but the generalization is easy. (Note that the 
following algorithm satisfies the big-pan property. If we do not care the property, the algorithm 
can be simplified a lot.) 

Algorithm Check. 

Input: Two subsets of a set X of N coins, X\ with size k and X\ = X \ X\ with size N — k. 
Output: YES iff the coins in X\ are all false and the coins in X\ are all fair. 

1. Divide X\ into k + 1 equal-sized subsets Yi, Y2, . . . , ife+i (recall the above assumption). 

2. Let L = Y\ and R = Y 2 . For i = 1 to log (k + 1), repeat Steps 2.1-2.2. 

2.1. Check if L and R are balanced by Steps 2.1.1-2.1.3. 

2.1.1. Construct arbitrarily two subsets V and R' of size iV/4 — \L\ (= iV/4 — |i?|) from 
X\(XxULUR) (this is possible since |X\(XiULUfl) I > N-k-\L\-\R\ > (N/4-\L\) + (N/A-\R\)). 

2.1.2. Compare L U L' and R U R' by a scale. If it is tilted, output NO. 

2.1.3. Compare R U V and L U R' by a scale. If it is tilted, output NO. 

2.2. Set L := L U R and # := L)jS+l F J- 

3. Output YES. 

Obviously, Check makes O(logfc) queries. The correctness of Check can be seen as follows: 
Observe that (i) if L' and R' are of different weight, at least one of Steps 2.1.2 and 2.1.3 is tilted, 
and (ii) if L' and R' are of the same weight, then both of Steps 2.1.2 and 2.1.3 are balanced if and 
only if L and R are of the same weight. Hence the algorithm essentially verifies if Y\ and Y2 are 
of the same weight, Y\ U Y2 and Y3 U Y4 are of the same weight, Y\ U • • • U I4 and Y5 U • • • U Y$ are 
of the same weight, and so on. If all the tests go through, then Y\ through Yfc+i are all the same 
weight, which cannot happen if X\ includes false coins since X\ includes at most k such ones. 

Finally, we adapt our algorithm so that it can satisfy the big-pan property. We simulate the 
transformation \q) 1— > (— l) q ' x \q) of the IP oracle by replacing a query string q £ {0, 1}^ with even 
Hamming weight I by two queries with Hamming weight ^JV/ 2j when 1/2 is even (similarly for 
the case where it is odd). We replace q by two iV-bit strings q\ and q\ with Hamming weight 1/2 
such that q = qi® q\. We take an arbitrary iV-bit string b with wt(b) = \_N/2\ — 1/2 such that 
1(6) n I{q) = 0. Note that both q\ ffi b and q 2 b have Hamming weight [N/2\ . (Recall that the 
Hamming weight of query strings must be even. So, if [-^V^J is odd, then we need an adjustment 
(— 1) of the Hamming weight when selecting b.) Since (— l)(5i®f)' x (— i)(?2ffi&)-s _ f or an y X) 

we can replace a query q to the IP oracle by two queries qi © b and §2 © b. Thus, we can simulate 
Find*{k) without changing the complexity (up to a constant factor). 

C Other Lower Bounds for Restricted Pans 

In addition to Theorem [21 we can show more lower bounds for the case where the size of pans is 
restricted. In what follows, L < I denotes the restriction that at most / coins must be placed on 
the pans whenever the balance is used. 

First, we give a lower bound for the case where the size of pans is "small." Note that Theorem 
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[5] implies that there is no o(/c 1//4 )-query algorithm placing at most 0(N/\/~k) coins on the pans 
whenever the balance is used. 

Theorem 5 If L < I, then we need fl(^kN/l min(/c, I)) weighings. In particular, we need fl( yj N/l) 
weighings. 

Proof. For simplicity, the following weight scheme is given when the size of each pan is I (that is, 
when q £ Qi). But the same bound is also obtained similarly when the size is at most /, and hence 
we can apply Lemma [3] for Q = {Jii < [ Qv to obtain the desired bound in the last of this proof. Let 
S = {x £ {0,1}^ | wt(x) = k} and f(x) = x. For (x,y) £ S x S, let w(x,y) = 1 if d(x,y) = 2 
(where d(x, y) denotes the Hamming distance between x and y) and otherwise. When the query q 
for x means that mi and 777-2 false coins are placed on the left and right pans, respectively, and q for 
y means that 777,3 an d 7774 false coins are placed on the left and right pans, respectively, we put the 
same weight for all w'(x, y, q)'s of such triples (x, y, q), which is denoted as w'((mi, 777,2), (7773, 7774)). 
Then we define 

w'( (7771,7772), (7773,7774)) 

a-m+i)(k-2^+i) if (wi, m 2 , m 3 , m 4 ) = (m - 1, m, m, m), (m, m - 1, 777, 777), 

(l—m+l)(k—2m+l) -r / \ / -i \ / i\ 

m{N-k-(2l-2m)) " m 2 , m 3 , m 4 ) = i m , "7, 777 - 1, 777), (777, 777, 777, 777 - 1), 

1 if one of m^'s is m and the others are m — 1, or 

(t77i, 7772, 7773, ?774) = (?7l + 1, 777 — 1, 777 , 777 ) , (777 — 1, 777 + 1, 777 , 777), 
(m, 777, 777 + 1, 777 — 1), (m, 777, 777 — 1, 777 + 1), 

otherwise, 

where 1 < m < min(A;/2, /). It is easy to see that the condition of a weight scheme is satisfied. 
Notice that for any x £ S we have /j(x) = k(N — k). Evaluating u(x, q) is a bit complicated. Since 
this value depends on the numbers of false coins on the two pans, mi and 7772, represented by the 
pair (x, q), we denote it by 1/(7771, 7772). We want to evaluate v(x, q)v(y, q) such that w(x, y) > 0, i.e., 
d{x,y) = 2 and x( x \l) xiu'il)- By symmetry, we can assume that x( x il) = 1 an d x(y'iQ) = 0- 
Since d{x,y) = 2, we need to consider only the following cases: (i) v(x,q) = v{m,m — 1) (or 
= 1/(777 — 1, 777)) and v(y, q) = 1^(777, 777) (where < 777 < min(/c/2, 1)); (ii) v(x, q) = v{m + 1, 777 — 1) 
(or = v{m — 1, 777+1)) and v(y, q) = v{m, m) (where < 777 < min(/c/2, 1)); (hi) v(x, q) = z/(tt7+1, m) 
(or = 7^(777, 777 + 1)) and v(y,q) = v(m,m) (where < 777 < min(/c/2, /)). In case of (i), 

v{x,q)= ^2 w'(x,y,q) 

y.d(x,y)=2, x(y;g)=0 

= w'((m, 777 — 1), (777 — 1, 777 — 1)) x 777(iV — k — (21 — (2m — 1))) 

+ w'((m, 777 - 1), (777, 777)) x (I — (777 - l))(k — (2m — 1)) 
< 2m(N -k-2l + 2m) 
= 0(mm(k,l)N), 



and 



v(y,q)= ^2 w'(y,x,q) 

x:d(x,y)=2, x(^;?)=l 

= (w'((m, 777), (777 + 1, 777)) + w'((m, m), (m, 777 + 1)))(/ — m)(k — 2m) 
+ (w'((m, 777), (777, 777 — 1)) + w'((m, 777), (777 — 1, m)))m(N — k — (21 — 2m)) 
+ (w'((m, 777), (777 + 1, 777 — 1)) + w'((m, 777), (777 — 1, 777 + 1)))?7T,(/ — 777) 
= 2(1 - m)(k - 777) + 2(1 - 777 + l)(k - 2m + 1) 
= 0(H), 
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and hence v(x, q)v(y, q) = 0(kNl min(/c, I)). Similarly, in case of (iii), it holds that v{x, q)v(y, \ 
0(kNlmin(k,l)). In case of (ii), 

is(x, q) = w ((m + 1, m — 1), (m, m)) x (I — (m — l))(m + 1) 

= (Z - m + l)(m + 1) = 0(min(/c/2, /)/) = 0(min(fc, Z)iV), 



and u(y, q) = 0(kl), and hence we also have u(x, q)v{y, 
Lemma [3] the quantum query complexity is at least 



O {kNl min(fe, Z)). From the above, by 



mm 

x,y,q: w(x,y)>0, 



v{x,<l)v{y,q) 



n 



kN 



I min(k, Z) 



This completes the proof. 



□ 



Second, we generalize Theorem [2] to the case where "big pans" and "small pans" are both 
available but "medium pans" are not. Here, U L < l\ or L > Z2" means that at most l\ coins or at 
least I2 coins (or their superposition) must be placed on the pans whenever the balance is used. 

Theorem 6 If L < l\ or L > l 2 where h < l 2 , then we need n(mxn({N /lik) 1 / 2 , (hk/N) 1 / 4 )) 
weighings. In particular, for any e > 0, if L < N/k 1+2€ or L > N/k l ~ ie , then we need Q(k € ) 
weighings. 

Proof. We can use the same weight scheme as the proof of Theorem [2j Let l\ = N/d\ and 
I2 = N/d2 with d\ > d2- The lower bound we should show is fi(min((cZi/ k) 1 / 2 , {k/d2) 1 ^))- Similar 
to the proof of Theorem [2J we can show that by Lemma [3] the quantum query complexity is at least 



/ 



n 



\ 



min / ri x )v(y) 





( 


= n 


mm . 

c>di \ 
\or <d,2 



(4) 



Then the theorem can be obtained from Eq. by using Lemma 2] for c < efo and the following 
lemma (Lemma [6]) for c > d\ . (Notice that it suffices to show Lemma [6] for c > 3 since the bound 
we should obtain from Lemma [U (di/k) 1 ^ 2 , is nontrivial only if d\ = ui(k) and hence the size of 
pans N/c (< Zi) should be considered only for c = oj(k)). 

Lemma 6 (( N k ) - 7 (iV, k, c))/( N k ) = 0{\) for any c > 3. 

Proof. Let us bound the probability that the scale is tilted when N/c coins (N coins include k 
false ones) are randomly placed on each of the two pans since it is exactly ((^) — 7(-ZV, k, c))/( fe ). 

/k\/ N-k \ 

Clearly, this probability is upper bounded by the sum X^m=i t'( m ) where t'(m) • 



I k \ I N-k 
\m)\2 

I N \ 
\2N/cJ 



denotes the probability of choosing exactly m false coins out of k ones when 2N/c coins are placed 
on the pans. Letting r'(m) := t'{m + l)/t'(m) = ^ m+ ^^}f^J^ m+1 ) , the sum is bounded by 



V t'{m) < (r'(0) + r'(0) 2 H )t'(0) (since r'(0) > r'(m) for all m > 1) 

r'(0) 



m=l 



< 



l-r'(O) 
O(r'(0)). 



(by f(0) < 1) 
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Since c > 3 and k < N/2, we can see that the following holds: 

r (0) s C iv- cfc -2iv = T • TTTTl = 

N c 

This completes the proof. □ 

Hence the proof of Theorem [6] is completed. □ 

Unfortunately, Theorem [6] does not give even a weakest nontrivial lower bound w(l) if the size 
of the pans is not restricted. One might have the hope by Theorem [6] that we could obtain a good 
upper bound by always placing approximately N/k coins on the pans, but Theorem [5] denies such 
a hope since we have an VL{k l l 2 ~ 2t ) lower bound for I = iV/A; 1_4e . 
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